berlin.de privacy policy — score 80/100 (low risk)
Zuletzt analysiert
Dieser Bericht ist älter als 28 Tage. Er zeigt die zuletzt gespeicherte Analyse für diese Richtlinie — aktualisiere, um die Live-Seite neu abzurufen und den Score zu aktualisieren.
Der Berichtsinhalt (Zusammenfassung, Befunde, Zitate) wurde auf Englisch erstellt und ist nicht lokalisiert.
Der Regierende Bürgermeister von Berlin – Senatskanzlei · berlin.de
Berichtsdetails
low RisikoThe Berlin Senate Chancellery's privacy policy is generally strong, using two-click consent for third-party media and anonymizing IPs, though it relies on standard contractual clauses for some sub-processors outside the EEA and lacks clarity on AI training.
The privacy policy of the Berlin Senate Chancellery (Senatskanzlei) demonstrates a high standard of GDPR compliance typical of German public authorities. It employs robust privacy-protective measures such as two-click solutions for YouTube, Google Maps, and Vimeo, ensuring no data is transmitted without explicit consent. IP addresses are truncated before processing for analytics (Mapp Intelligence), and analytics data is stored exclusively in Germany. However, there are notable gaps: video provider movingimage and chart tool Datawrapper use sub-processors in third countries relying solely on Standard Contractual Clauses (SCCs), and the retention period for contact form data is vaguely defined. Additionally, the policy is entirely silent on whether any integrated services use data for AI model training.
Kategoriebewertung
Aufschlüsselung der Richtlinie nach zentralen Compliance-Bereichen. Gut = stark, mittel = gemischt, schlecht = bedenklich.
IP addresses are truncated/anonymized before processing for analytics and translation, and forms only request necessary data.
The policy is highly structured, detailing specific legal bases, purposes, and retention periods for each distinct processing activity.
While two-click solutions prevent passive tracking, data is shared with several US tech companies (Google, Vimeo) and sub-processors upon consent.
Analytics data is kept in Germany, but movingimage and Datawrapper explicitly use sub-processors in third countries under SCCs.
The policy is entirely silent on whether integrated services (like translation or analytics) use processed data for training their own AI models.
All standard GDPR rights are clearly listed with contact details for the Data Protection Officer and the supervisory authority.
Wichtigste Befunde
Bemerkenswerte Klauseln, Probleme oder positive Praktiken (kritische zuerst)
Third-Country Transfers via Sub-processors
movingimage and Datawrapper use sub-processors (CDNs) in third countries, relying on Standard Contractual Clauses (SCCs) without mentioning supplementary technical measures, which may be insufficient post-Schrems II.
Ambiguous Retention for Contact Forms
While browser data is deleted after 14 days, contact form data is kept until the 'conversation is concluded,' which is subjective and lacks a hard maximum retention period.
Strong Two-Click Implementation for Media
Google Maps, YouTube, and Vimeo are implemented with preview images and require active consent ('Akzeptieren und Anzeigen') before connecting to external servers, preventing passive data leakage to US tech companies.
IP Anonymization and Local Storage for Analytics
Mapp Intelligence truncates IP addresses before processing and stores data exclusively in Germany, mitigating cross-border transfer risks for analytics data.
Silence on AI/Model Training
The policy does not disclose whether any integrated third-party services (such as Conword for translation or Mapp for analytics) use the processed data for their own AI or machine learning model training.
Fazit für Nutzer
Your data is generally well-protected on this government site, especially since videos and maps only load if you click to accept them, but be aware that some underlying tools might send data to servers outside the EU.
Compliance-Posture
The controller demonstrates a strong compliance posture, leveraging specific legal bases (Art. 6(1)(e) and (f)) for public task operations and implementing data protection by design (e.g., IP anonymization, two-click integrations). The main weaknesses are the reliance on SCCs without mentioning supplementary measures for third-country transfers, and ambiguous retention timelines for correspondence.
EU-Übermittlungen
Data transfers to third countries occur via movingimage and Datawrapper sub-processors (CDNs), relying on Standard Contractual Clauses. Google and Vimeo are US-based but are activated only after user consent. Analytics data is explicitly kept within Germany.
Erkannte Signale
Konkrete Datenpunkte und Praktiken im Text identifiziert
Textbelege
Direkte Zitate aus der Richtlinie, die diese Befunde stützen
Die Google Maps Karten sind mit einem Vorschaubild versehen, um zu vermeiden, dass bereits bei Betreten der Seite Daten an Google übermittelt werden.
Die IP-Adresse wird vor jeglicher Verarbeitung gekürzt und in anonymisierter Form zur Session-Erkennung und für die Geolokalisierung (bis auf Stadt-Ebene) verwendet.
movingimage setzt Unterauftragsverarbeiter in Drittstaaten ein. Insbesondere handelt es sich hierbei um den Betreiber des Content Delivery Networks (CDN).
Beendet ist die Konversation dann, wenn sich aus den Umständen entnehmen lässt, dass der betroffene Sachverhalt abschließend geklärt ist.
Fehlend oder unklar
- No mention of supplementary technical measures for third-country transfers alongside SCCs
- No explicit hard deadline for deleting contact form data
- No disclosure regarding AI model training by third-party processors
Fragen zum Nachfragen
- What specific technical and organizational measures ensure that Mapp Digital US cannot access the analytics data stored exclusively in Germany?
- Which specific third countries do the movingimage and Datawrapper sub-processors (CDNs) operate in, and have supplementary measures been implemented alongside SCCs?
- How is the conclusion of a 'conversation' via the contact form objectively determined to trigger deletion, and is there a maximum timeout?
- Do any of the integrated third-party services (like Conword or Mapp Intelligence) use the processed data for training their own AI or machine learning models?
Diese Analyse teilen
Jeder mit diesem Link kann das Ergebnis oben einsehen.
Entwickelt von DentroChat
100 % europäischer KI-Chat für alle
Chatte mit KI, arbeite mit Dateien, generiere Bilder und suche im Web. Daten bleiben in Europa.